Do not require auth when editing the profile

[azure-ad-b2c]

Do not require auth when editing the profile

[marcelodiiorio]

Hi! You have to configure SSO settings accordingly. If you are using user flows, it's in the session behavior settings. In case of custom policies, see my sample use case https://github.com/marcelodiiorio/My-Azure-AD-B2C-use-cases/tree/master/Configuring%20B2C%20as%20JWT%20issuer%20using%20OAUTH-OIDC

[JasSuri]

You do not need to do anything. The default SSO already applies without reconfiguring the custom policy. Try this, use the Sign In/Up policy in one browser tab. Then use the Profile Edit journey in another tab in the same browser - make sure to remove prompt=login query parameter if it exists. Youll see the user can directly edit the profile without providing credentials.

[kstro21]

@JasSuri the user can directly edit the profile without providing credentials when it is a local account, but when the user registered with a provider(Google or Facebook) it is asking for the provider credentials again.

Is it how it works or can we change that? I mean, not asking for credentials when the user is from a provider.

[JasSuri]

@kstro21 This would be because the session management technical profile for the social account logon is different to that of the local account sign in. If you set the same session management technical profile for both, it should give SSO.

[kstro21]

@JasSuri that would be a configuration on the provider side or it is something a need to change in my custom policies(the XML files)? An example would be great or just a link pointing the right direction.

Thanks

[ylulloa]

@kstro21 / @JasSuri: Same happens to me. The scenario is when I'm using multiple accounts on my browser. Let's say I have my personal google account and my work google account. However, If I open an incognito instance of the browser, I can't replicate it because I end up with only one account there.

How can we tell b2c... this app is using this account on the URL that redirects to b2c user profile?

[JasSuri]

The proper way to solve this with the default starter pack would be to send the domain_hint. This way the user gets SSO via their social IdP too.